import type { NodeKeyPair } from '@forgezero/runtime/identity';
import { type SignedNodeHttpOptions } from './signed-node-http';
import type { AgentOperationTelemetry } from './telemetry-runtime';
interface RemoteProvisionClaimBase {
    computeKey: string;
    claimToken: string;
    claimExpiresAtTs: number;
    attempt: number;
    spec: {
        reference: string;
        imageKey: string;
        /** Stable bootstrap placement. Online tenant placement normally omits these. */
        guestName?: string;
        guestAddress?: string;
        cpuPoolKey?: string;
        physicalCores: number;
        vcpu: number;
        memoryGib: number;
        diskGib: number;
        /** Absent only on pre-encryption claims; normalized to `none` by the Metal Agent. */
        diskEncryption?: 'none' | 'luks2';
        egressGuaranteedMbps: number;
        egressBurstMbps: number;
        confidential: boolean;
    };
    /** Desired public binding. Receiving it is not proof that the host applied
     * it; the completion report may include network evidence only after the
     * configured network helper has actually installed it. */
    network?: {
        publicAddress: string;
        networkAddressKey: string;
        scope: 'global' | 'server';
    };
}
export interface GuestAccess {
    sshUser: string;
    /** Public keys only. Private SSH material is never part of a claim. */
    sshPublicKeys: string[];
}
export type CreateRemoteProvisionClaim = RemoteProvisionClaimBase & {
    action?: 'create';
    access?: GuestAccess;
} & ({
    enrolment: {
        token: string;
        tenantKey: string;
        deploymentKey?: string;
        environmentKey: string;
    };
    bootstrap?: never;
} | {
    bootstrap: {
        kind: 'platform-genesis';
    };
    enrolment?: never;
});
export type RemoteProvisionClaim = CreateRemoteProvisionClaim | (RemoteProvisionClaimBase & {
    action: 'delete';
    /** Present only for the operator-laptop authority before platform genesis. */
    bootstrap?: {
        kind: 'platform-genesis';
    };
});
export interface ProvisionResult {
    guestAddress?: string;
    /** Exact local application facts. The API independently compares every field
     * to the fenced purchase before changing readiness or IP assignment. */
    applied?: {
        resources: {
            physicalCores: number;
            vcpu: number;
            memoryGib: number;
            diskGib: number;
            diskEncryption: 'none' | 'luks2';
            egressGuaranteedMbps: number;
            egressBurstMbps: number;
            confidential: boolean;
        };
        access?: GuestAccess;
        network?: {
            publicAddress: string;
            networkAddressKey: string;
            scope: 'global' | 'server';
        };
    };
}
export type ProvisionRunner = (claim: RemoteProvisionClaim) => Promise<ProvisionResult>;
export interface ProvisioningPullOptions extends SignedNodeHttpOptions {
    keys: NodeKeyPair;
    run: ProvisionRunner;
    /** Inventory record this physical host was deliberately configured to serve. */
    metalHostname?: string;
    intervalMs?: number;
    completionAttempts?: number;
    sleep?: (ms: number) => Promise<void>;
    now?: () => number;
    renewRetryMs?: number;
    setTimer?: (callback: () => void, ms: number) => unknown;
    clearTimer?: (handle: unknown) => void;
    onEvent?: (event: string, detail?: unknown) => void;
    /** Fresh local facts, sent signed before this host may claim work. */
    metalPreflight?: () => {
        snpHost: boolean;
        kvm: boolean;
        helper: boolean;
    };
    telemetry?: AgentOperationTelemetry;
}
export type ProvisionPullResult = {
    status: 'idle';
} | {
    status: 'running';
    claim: RemoteProvisionClaim;
    result: ProvisionResult;
} | {
    status: 'terminated';
    claim: RemoteProvisionClaim;
    result: ProvisionResult;
} | {
    status: 'failed';
    claim: RemoteProvisionClaim;
    reason: string;
};
/** Claim one compute, await the local helper, then durably acknowledge it. */
export declare function pullProvisioningOnce(options: ProvisioningPullOptions): Promise<ProvisionPullResult>;
export declare function startProvisioningPull(options: ProvisioningPullOptions): {
    stop(): Promise<void>;
    pause(): Promise<void>;
    resume(): void;
    readonly active: boolean;
};
export {};